July 5, 2013

EU lawmakers are cracking down on cyber-criminals with new legislation proposing tougher penalties across the European Union.

Under the new rules, hackers will face a minimum of two years in prison for attempting to gain illegal access to information systems, a minimum of three years for using botnets and a minimum of five years for attacking important infrastructure such as power plants or transport or government networks.

EU Commissioner for Home Affairs Cecilia Malmström described the new rules as an “important step to boost Europe’s defences against cyber-attacks.”

“The perpetrators of increasingly sophisticated attacks and the producers of related and malicious software can now be prosecuted, and will face heavier criminal sanctions,” Malmström said in a press release.

“Member States will also have to quickly respond to urgent requests for help in the case of cyber-attacks, hence improving European justice and police co-operation. Together with the launch of the European Cybercrime Centre and the adoption of the EU Cyber-security Strategy, the new Directive will strengthen our overall response to cyber-crime and contribute to improve cyber security for all our citizens.”

The new legislation builds on rules that have been in place for the past eight years. While preserving a number of the original provisions, the directive also deals with new offences, such as the use of tools to commit large-scale attacks.

The legislation focuses on the improvement of cross-border co-operation between the judiciary and the police in each of the EU states, that, in turn, obliges these states to “make better use of the existing 24/7 network of contact points by treating urgent requests within eight hours,” according to the press release.

Member states will also be obligated to gather statistical data on cyber-attacks and to have reporting channels in place for reporting of the offences to competent authorities.

The European Parliament voted 541 to 91 in favor of the legislation with nine abstentions. The legislation is to be formally adopted by the council “very shortly.”

Once adopted, member states — with the exception of Denmark — will have two years to transpose it into national law although